China-Nexus VAPOR PANDA hacked nine of over 200 targets with AI agents

CrowdStrike said China-linked adversary VAPOR PANDA used the AI-based ARTEX intrusion framework, running primarily on the Chinese-developed DeepSeek large language model and a second commercial model, to target more than 200 organizations in at least 14 countries in an 11-day window starting October 17, 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations in a report published on October 29. 2026.

CrowdStrike OverWatch observed exploit activity coming from a single ARTEX controller, which CrowdStrike Intelligence connected to the VAPOR PANDA infrastructure. The controller periodically exposed adversary tools, target files, and agent transcripts, indicating multiple commitments, called tasks within the framework, executed against multiple targets. In the nine organizations with confirmed post-exploitation activity, the adversary gained access, deployed the BLOODALCHEMY backdoor, and proceeded to credential dissemination, network scanning, and reconnaissance. The adversary also conducted password spraying and credential scanning activities against at least 12 other organizations, including US-based think tanks and government entities in Europe.

Targeting across regions and sectors

CrowdStrike reported that VAPOR PANDA carried out extensive intrusions into the foreign ministries of two Latin American-based countries, possibly hacked into a third, and organized target files for later use against foreign ministries in Central America and Asia. The adversary also compromised an Interior Ministry based in the Middle East.

CrowdStrike said one effort focused on a single European country: its foreign ministry, presidency and prime minister’s office, as well as defense, justice, finance and intelligence entities. Another effort included 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors. Telecommunications providers in the United States, Belgium and the Philippines were also compromised.

Inside the ARTEX operation

CrowdStrike said VAPOR PANDA operated ARTEX primarily under the DeepSeek model, complemented by a second commercial subscription-based LLM that CrowdStrike Intelligence could not confirm. In a single intrusion, the adversary’s scheduling agents consumed approximately 1.4 billion input tokens, a figure that CrowdStrike says indicates the scale of the automated activity and implies that the operation as a whole consumed much more.

According to CrowdStrike, ARTEX pairs a master agent with planner agents and subordinate workers who share a graph of facts, results, and goals, moving each effort from initial access through host reconnaissance to lateral movement. The facility kept a human in the loop. The recovered transcripts showed an operator issuing instructions in Chinese, labeled “human instruction” and timestamped in China Standard Time, telling agents to create web shells, extract domain administrator credentials, and verify endpoint sensor coverage.

The report detailed the agent’s work at two U.S.-based pharmaceutical organizations. Initially, the agent combined an unsigned Security Assertion Markup Language (SAML) assertion with an XML external entity (XXE) defect to reach the Instance Metadata cloud service, resulting in a role capable of issuing administration commands to thousands of instances, and from there retrieved an enterprise administrator account. In the second phase, the agent installed web shells, leveraged an unauthenticated orchestration service to gain root access within a production container environment, read Local Administrator Password Solution passwords, and misused resource-based constrained delegation to impersonate a privileged account.

The report also describes an engagement against a Greek government agency, in which the operator provided the agent with a 2022 directory export from the organization’s mail server that contained authentication keys that have likely never been rotated since. The agent used those keys to spoof an administrator token and read mailboxes, then entered the internal network via VPN configurations taken from mail sent by a user and a VPN client key that the operator said came from a May 2024 email leak.

CrowdStrike said that during these engagements agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructures, and switched to alternative approaches when one path failed. Where it had previously observed threat actors using AI agents to assist individual intrusions, VAPOR PANDA conducted multiple interventions simultaneously, intervening only to redirect agents at decision points. The operator also caused agents to evade endpoint defenses: At a global pharmaceutical organization, the operator told agents to “find Windows machines in the domain without Falcon, judging by the task list and folder lists,” using what CrowdStrike identified as PRC red team jargon for the CrowdStrike Falcon sensor.

Distribution of BLOOD ALCHEMY

CrowdStrike reported that at a Middle East-based Ministry of the Interior and a Latin America-based Foreign Ministry, VAPOR PANDA implemented BLOODALCHEMY, a backdoor first publicly documented in October 2023. The adversary renamed a legitimate GameHook binary as svchost.exe and used it to load a malicious DLL, graphics-hook-filter64.dll, which once decrypted the BLOODALCHEMY payload file. graphics-hook_config.bin and organized copies of all three files in exposed open directories. The implant contains an internal project path, D:\ProjectX\Merman_New\, which CrowdStrike says likely reflects the name of the malware’s internal development. BLOODALCHEMY communicated with the VAPOR PANDA infrastructure, including the command and control domains nginxmysql.com and sqlserver-sqlite.com, indicators that, according to the report, do not appear in ARTEX’s previous public reports.

Evaluation and recommended defenses

CrowdStrike said this campaign stands out from ARTEX asset industry sources reported under the Storm-0940 designation, which it believes likely indicates the framework is rapidly gaining popularity among several China-linked adversaries. Since 2021, VAPOR PANDA has primarily pursued government, think tank, energy and extractive organizations in Europe, North America, Oceania and the United Kingdom in order to build long-term access. The report describes this campaign as the first time CrowdStrike has seen the adversary use AI-based intrusion tools and a notable expansion of its targeting towards pharmaceutical, semiconductor, nuclear and defense organizations and foreign ministries in new regions. According to the report, the operation’s reliance on DeepSeek and other commercial models, managed through a purpose-built system, likely reflects a deliberate attempt to build a resilient tool chain across different model providers instead of relying on a single service.

CrowdStrike assessed that China nexus adversaries will most likely continue to adopt agent structures like ARTEX over the next 12 months, pairing them with commercially available LLMs and allowing small teams to scale intrusions on multiple targets simultaneously.

The report recommends that organizations rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys found in historical backups and directory exports; enforce SAML signature validation, require IMDSv2, and limit cloud role command execution permissions to the minimum required instances; look for ARTEX markers as artx or artex strings in command line parameters, cloud roles prefixed with artx, and the C:\ProgramData\artx5v\ directory; patch Internet-connected equipment, especially long-running Linux-based servers; and deploy a real-time endpoint detection and response agent across your environment, including servers deemed unreachable from the public internet.